SSO by httpclient call from sharepoint to WebApi 2 using ADFS as IdP

Question

I am facing here a problem with sharing the sharepoint Fedauth cookie with an WebApi application where both sharepoint and WebApi registred by ADFS. Both applications are hosted under the same domain and on-premise but on different machines. We have the same implementation between the WebApi and another MVC application where everything works fine. We are able to establisch sso calls both through the browsers as with server side httpclient calls. In other words:

We are able to establish SSO between Sharepoint and Webapi through the browser. We are unable to establish SSO between Sharepoint and Webapi through Httpclient call. We get the next error in the windows event viewer:

Exception type: SecurityTokenException Exception message: ID4230: The SecurityToken was not well formed. Expecting element name 'SecurityContextToken', found 'SP'. at System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver)

I have read some topics on the internet where it is recommended to give the fedauth cookie another unique name. However this was unsuccesfull as the webpi redirect the call to ADFS.

Any help will be apreciated.

Answer 1

After doing lot of search I came out with next results:

1. Sharepoint stores a reference to the SessionSecurityToken instead of the token self like any other Standard WIF implementation does. For this reason no other WIF application would be able to read the content of the sharepoint Fedauth cookie.

2. Sharing Cookies between applications is seen as unsecrue and bad practice as men should share the same machinekey for both applications to make them able to read fedauth cookies.

3. In similair scenario the following alternatives are considered more suitable: . Implementing identity delegation based upon the actas token provied by ADFS: Check this link about identity deleagtion . Other options are like using poorman delegation can be found in the following answer